97 lines
2.5 KiB
PHP
97 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace MintyPHP\Http;
|
|
|
|
use MintyPHP\I18n;
|
|
use MintyPHP\Router;
|
|
|
|
/**
|
|
* Handles public path detection and authentication guards.
|
|
*/
|
|
class AccessControl
|
|
{
|
|
/** Paths that are always public (no auth required) */
|
|
private const ALWAYS_PUBLIC_PATHS = [
|
|
'login',
|
|
'register',
|
|
'verify-email',
|
|
];
|
|
|
|
/** Prefixes that are always public */
|
|
private const ALWAYS_PUBLIC_PREFIXES = [
|
|
'password/',
|
|
'branding/',
|
|
'flash/',
|
|
];
|
|
|
|
private array $configuredPublicPaths;
|
|
|
|
public function __construct(?array $publicPaths = null)
|
|
{
|
|
$this->configuredPublicPaths = $publicPaths ?? (defined('APP_PUBLIC_PATHS') ? APP_PUBLIC_PATHS : []);
|
|
}
|
|
|
|
/**
|
|
* Check if a path is publicly accessible (no authentication required).
|
|
*/
|
|
public function isPublicPath(string $path): bool
|
|
{
|
|
$normalizedPath = $this->normalizePath($path);
|
|
|
|
// Root path check
|
|
if ($normalizedPath === '/') {
|
|
return in_array('/', $this->configuredPublicPaths, true);
|
|
}
|
|
|
|
// Check configured public paths
|
|
if (in_array($normalizedPath, $this->configuredPublicPaths, true)) {
|
|
return true;
|
|
}
|
|
|
|
// Check page/ prefix with slug lookup
|
|
if (str_starts_with($normalizedPath, 'page/')) {
|
|
$pageSlug = substr($normalizedPath, strlen('page/'));
|
|
if (in_array($pageSlug, $this->configuredPublicPaths, true)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
// Check always-public paths
|
|
if (in_array($normalizedPath, self::ALWAYS_PUBLIC_PATHS, true)) {
|
|
return true;
|
|
}
|
|
|
|
// Check always-public prefixes
|
|
foreach (self::ALWAYS_PUBLIC_PREFIXES as $prefix) {
|
|
if (str_starts_with($normalizedPath, $prefix)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Redirect to login if the path requires authentication and user is not logged in.
|
|
*
|
|
* @return bool True if access is allowed, false if redirected
|
|
*/
|
|
public function requireAuthOrRedirect(string $path, bool $isLoggedIn): bool
|
|
{
|
|
if ($this->isPublicPath($path) || $isLoggedIn) {
|
|
return true;
|
|
}
|
|
|
|
$locale = I18n::$locale ?? I18n::$defaultLocale;
|
|
Router::redirect(Request::withLocale('login', $locale));
|
|
|
|
return false;
|
|
}
|
|
|
|
private function normalizePath(string $path): string
|
|
{
|
|
$normalized = trim($path, '/');
|
|
return $normalized === '' ? '/' : $normalized;
|
|
}
|
|
}
|